snyk 1.913.0 → 1.916.0

package/README.md

@@ -61,7 +61,7 @@ Use [GitHub Releases](https://github.com/snyk/snyk/releases) to download a stand
 
 We also provide these standalone executables on our official CDN. See [the `release.json` file](https://static.snyk.io/cli/latest/release.json) for the download links:
 
-```http
+```text
 https://static.snyk.io/cli/latest/release.json
 
 # Or for specific version or platform
@@ -87,6 +87,44 @@ You can also use these direct links to download the executables:
 
 Drawback of this method is, that you will have to manually keep the Snyk CLI up to date.
 
+#### Verifying standalone binaries
+
+You can verify both shasum of downloaded binaries and their GPG signatures.
+
+Download location on `static.snyk.io` contains a file called `sha256sums.txt.asc`.
+You can download it directly `https://static.snyk.io/cli/latest/sha256sums.txt.asc` or for a specific version like `https://static.snyk.io/cli/v1.666.0/sha256sums.txt.asc`.
+
+To check that a downloaded file matches the checksum, use a `sha256sum` command like so:
+
+```bash
+grep snyk-macos sha256sums.txt.asc | sha256sum -c -
+```
+
+If you want to verify Snyk CLI standalone binaries against [Snyk CLI GPG key](help/_about-this-project/snyk-code-signing-public.pgp), you will need to import it first:
+
+```bash
+# 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569 is the key belonging to code-signing@snyk.io
+# Copy of this public key is also in this repository /help/_about-this-project/snyk-code-signing-public.pgp
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
+```
+
+Then verify the file is signed with:
+
+```bash
+gpg --verify sha256sums.txt.asc
+```
+
+Command output should look like:
+
+```plain
+gpg: Signature made Mon Apr 25 16:55:01 2022 CEST
+gpg:                using RSA key 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
+gpg: Good signature from "Snyk Limited <code-signing@snyk.io>" [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg:          There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 68BF BCCE B779 4E6F C06A  2044 A29C 32E9 1F4B 9569
+```
+
 </details>
 
 <details>

package/config.default.json

@@ -4,7 +4,6 @@
   "devDeps": false,
   "PRUNE_DEPS_THRESHOLD": 40000,
   "MAX_PATH_COUNT": 1500000,
-  "CODE_CLIENT_PROXY_URL": "https://deeproxy.snyk.io",
   "NPM_TREE_SIZE_LIMIT": 6.0e6,
   "YARN_TREE_SIZE_LIMIT": 6.0e6
 }

package/dist/cli/479.index.js

@@ -177773,6 +177773,8 @@ function inspect(root, targetFile, options) {
         const mvnArgs = buildArgs(root, mvnWorkingDirectory, targetFile, options.args);
         let result;
         try {
+            debug(`Maven command: ${mavenCommand} ${mvnArgs.join(' ')}`);
+            debug(`Maven working directory: ${mvnWorkingDirectory}`);
             result = yield subProcess.execute(mavenCommand, mvnArgs, {
                 cwd: mvnWorkingDirectory,
             });